Rapid Return
Sign In

Privacy Policy

How Rapid Return Pty Ltd collects, uses, discloses, stores, and manages personal information.

Last updated: 9 April 2026

Rapid Return Pty Ltd Version 1.0

Rapid Return Pty Ltd (ABN: 62 669 553 879) is a Tax Practitioners Board registered tax agent (Registration No. 26257475) operating the online tax lodgment platform at rapidreturn.com.au.

This page reflects Rapid Return's current Privacy Policy, effective 9 April 2026. It should be read together with our Terms and Conditions and the DVS Identity Verification Consent Notice presented during onboarding.

For privacy enquiries, access requests, correction requests, or complaints, contact support@rapidreturn.com.au.

1. Introduction

Rapid Return Pty Ltd (ABN: 62 669 553 879) ("Rapid Return", "we", "us", "our") operates the online tax lodgment platform available at rapidreturn.com.au (the "Platform"). We are authorised to prepare and lodge individual income tax returns on behalf of Australian taxpayers.

We are committed to protecting the privacy of your personal information. This Privacy Policy explains how we collect, use, disclose, store, and manage your personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Tax Agent Services Act 2009 (Cth), and, for identity verification, the Identity Verification Services Act 2023 (Cth) and Identity Verification Rules 2024 (Cth).

This policy applies to personal information collected through the Platform, our website, and in connection with our tax agent services. By using the Platform, you agree to the collection and use of your personal information as set out in this Privacy Policy.

2. What personal information we collect

2.1 Identity and contact information

  • Full legal name, including title, first name, middle name, and last name.
  • Date of birth and gender.
  • Residential and postal address.
  • Email address and phone number.

2.2 Tax and financial information

  • Tax File Number (TFN), collected and handled in accordance with the Privacy Act and TFN Guidelines. Your TFN is encrypted at rest and used only for preparing and lodging your tax return with the ATO.
  • Income information, including employment income, government payments, investment income, business income, and other assessable income relevant to your return.
  • Deductions and offsets information entered in your tax return.
  • Private health insurance details.
  • Government loan details such as HECS-HELP and VET Student Loans.
  • Bank account details, including BSB and account number, to confirm your refund destination and facilitate the Fee from Refund service where selected.
  • ATO pre-fill data retrieved on your behalf, including income statements, government payment summaries, health insurance data, and other ATO-held information.
  • Prior year tax return information and ATO lodgment history.

2.3 Identity verification information

We are required to verify your identity before providing tax agent services. We use the Australian Government's Document Verification Service (DVS), which is authorised and regulated under the IVS Act. Depending on the document you choose to present, we collect:

  • Passport number, country of issue, and expiry date.
  • Driver licence number, state or territory of issue, and expiry date.
  • Medicare card number, individual reference number, and expiry date.

These details are submitted through our approved DVS Gateway Service Provider, GBG Pty Ltd, to the relevant government record-holding agency. The DVS returns only a pass, fail, or error result and does not return your document details to us. We retain a record of the verification outcome only.

Identity document details are used solely for identity verification and not for any secondary purpose, including profiling or marketing.

2.4 Technical and usage information

  • IP address.
  • Browser type and version.
  • Device type and operating system.
  • Pages visited, time spent on the Platform, and navigation patterns.
  • Session authentication data.
  • Error logs and system event data.
  • Advertising click and conversion data where you arrived via a Google Ads campaign.

2.5 Payment information

  • Payment transaction records, including amounts, dates, and transaction identifiers.

Credit and debit card details are collected and processed directly by our payment processor. We do not store your full card number on our systems.

2.6 Communications and support

  • Content of support enquiries or messages you send to us.
  • Feedback and reviews you provide following lodgment.

2.7 Referral information

  • Referral codes used at signup and details of the referral relationship where applicable.

3. How we collect your personal information

3.1 Directly from you

  • When you register for an account on the Platform.
  • During onboarding, when you provide your TFN, date of birth, address, and contact details.
  • When you complete your tax return on the Platform.
  • When you submit identity documents for DVS verification.
  • When you enter payment details.
  • When you contact us for support or send us correspondence.

3.2 From the Australian Taxation Office

As your registered tax agent, we are authorised to retrieve data from the ATO on your behalf, including pre-fill data, lodgment history, and income tax account information.

By appointing Rapid Return as your tax agent and completing the ATO linking process during onboarding, you authorise us to access this information.

3.3 Via the Document Verification Service

When you complete identity verification, your identity document details are submitted to the DVS through GBG Pty Ltd. The third-party entities involved are:

  • GBG Pty Ltd, our approved DVS Gateway Service Provider.
  • The DVS Hub, administered by the Attorney-General's Department.
  • The relevant Official Record Holder for the document you present, such as the Department of Home Affairs, a state or territory road authority, or Services Australia.

You are presented with a separate DVS Identity Verification Consent Notice before any verification check is initiated.

3.4 From third parties

  • Our payment processor for transaction confirmation and payment status information.
  • Google Ads for click and conversion attribution data where applicable.
  • Referral partners for basic referral attribution data where applicable.

3.5 Automatically via our Platform

We collect certain technical and usage information automatically when you interact with the Platform through session management tools and analytics. See Section 10 for more information about cookies.

4. Why we collect and how we use your personal information

4.1 Providing tax agent services

  • Preparing, reviewing, and lodging your individual income tax return with the ATO.
  • Retrieving your ATO pre-fill data and lodgment history.
  • Communicating with the ATO on your behalf as your registered tax agent.
  • Providing tax-related information, recommendations, and reminders relevant to your return.

4.2 Identity verification

  • Verifying your identity via the DVS before providing tax agent services.
  • Linking your account to the ATO using your TFN and date of birth.

4.3 Account and Platform management

  • Creating and managing your Platform account.
  • Authenticating your identity at login and enabling two-factor authentication.
  • Sending transactional notifications, including lodgment confirmations, ATO receipt numbers, and payment receipts.

4.4 Payments

  • Processing service fees.
  • Administering the Fee from Refund service, including receiving ATO refund amounts, deducting applicable service fees, and disbursing the remaining balance to your nominated bank account.
  • Maintaining payment and financial records.

4.5 Platform improvement and analytics

  • Understanding how users interact with the Platform to improve features and performance.
  • Measuring the effectiveness of our advertising.
  • Monitoring and resolving technical issues.

4.6 Marketing and communications

We may send you tax season reminders and information about our services where you have consented or where this is otherwise permitted under the Spam Act 2003 (Cth).

You may opt out of marketing communications at any time by clicking the unsubscribe link in a marketing email or contacting us at support@rapidreturn.com.au. Opting out does not affect our ability to send transactional messages related to your tax affairs.

4.7 Legal and compliance

  • Complying with obligations under the Privacy Act, TASA, the IVS Act, and other applicable laws.
  • Maintaining audit trails required by the ATO and the Tax Practitioners Board.
  • Retaining records for the minimum periods required by law.
  • Responding to legal processes, regulatory requests, or law enforcement inquiries.

5. Disclosure of your personal information

5.1 Australian Taxation Office

We disclose personal information to the ATO in our capacity as your registered tax agent, including for lodging your tax return, verifying your identity and TFN, and accessing pre-fill data.

5.2 DVS Gateway Service Provider and related parties

Your identity document details are disclosed to GBG Pty Ltd, the DVS Hub, and the relevant Official Record Holder during identity verification. These disclosures are limited to what is necessary for the verification check and are governed by the DVS Participation Agreement and the IVS Act.

5.3 Service providers

We engage third-party providers to help operate the Platform and deliver our services. They may use your personal information only to the extent necessary to provide services to us and not for their own purposes.

  • Cloud infrastructure and database provider, with data stored in Sydney, Australia.
  • Lodgment gateway provider in Australia for submitting tax returns to the ATO.
  • Payment processor located overseas for card payments. Card details are handled directly by the processor and not stored on our systems.
  • Payment disbursement provider in Australia for the Fee from Refund service.
  • Email delivery provider located overseas for transactional and marketing emails.
  • Advertising platform located overseas for conversion tracking and advertising effectiveness.

Some service providers are located in, or store data in, the United States and the European Union. Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, including through contractual arrangements.

5.4 Professional and legal advisers

We may disclose personal information to legal, accounting, or other professional advisers on a confidential basis where needed for the management of our business.

5.5 Business transactions

If Rapid Return is involved in a merger, acquisition, or sale of some or all of its business or assets, personal information may form part of the transferred assets. We will notify you by posting a notice on our website.

5.6 Legal and regulatory requirements

We may disclose personal information where required or authorised by law, including to courts, tribunals, regulatory authorities, and law enforcement agencies.

5.7 What we do not do

  • We do not sell your personal information to third parties.
  • We do not disclose your TFN to any party other than the ATO and parties authorised under the Privacy Act to receive it.
  • We do not use identity document details obtained via the DVS for any purpose other than identity verification.
  • We do not share your personal information with third parties for their own marketing purposes.

6. Sensitive information

Sensitive information includes information such as health data, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, and membership of professional or trade associations.

During tax return preparation, you may provide information that is sensitive, such as details about a disability, union or professional association membership, or certain government payments. We collect this information only where you voluntarily provide it and only for preparing and lodging your return.

We do not use sensitive information for any secondary purpose. TFN information is handled in accordance with the Tax File Number Guidelines 2011 issued under the Privacy Act.

7. Unsolicited personal information

If we receive personal information that we did not request, we assess whether it could have been collected by us in the ordinary course of providing our services. If it could not have been, we will destroy or de-identify it as soon as practicable unless we are required by law to retain it.

8. Retention of your personal information

We retain personal information for as long as necessary to provide our services and comply with legal obligations.

  • Tax return records and supporting documentation: at least 5 years from lodgment, as required by the ATO.
  • TFN records: for the duration of your engagement with us as your tax agent and for 5 years after that, in accordance with the TFN Guidelines.
  • DVS verification records, being pass or fail outcomes only, for audit and compliance purposes under our DVS Participation Agreement.
  • Payment records: as required under the Corporations Act 2001 (Cth), generally for at least 7 years.
  • Account and profile information: while your account is active and for a reasonable period after closure, subject to the minimum retention periods above.

When personal information is no longer required and applicable retention periods have expired, we take reasonable steps to destroy or de-identify it securely.

9. Security of your personal information

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure.

  • Encryption of sensitive data, including your TFN, at rest using industry-standard encryption.
  • SSL/TLS encryption for data transmitted between your device and the Platform.
  • Role-based access controls that limit access to authorised personnel only.
  • Audit logging of access to and modifications of personal information within the Platform.
  • Two-factor authentication available for all user accounts.
  • Cloud infrastructure hosted in Sydney, Australia with physical and electronic security controls.
  • Regular monitoring and review of security practices.

No method of internet transmission or electronic storage is completely secure, so we cannot guarantee absolute security. If we become aware of a data breach likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

10. Cookies

The Platform uses cookies and similar tracking technologies. Cookies are small data files placed on your device to help us operate and improve the Platform.

10.1 Types of cookies we use

  • Essential cookies required for the Platform to function, including authentication session tokens that keep you logged in securely.
  • Analytics and advertising cookies, including Google Analytics and Google Ads conversion tracking, to understand how users find and use the Platform and to measure advertising effectiveness.
  • Preference cookies that remember your settings and preferences on the Platform.

10.2 Managing cookies

You can manage or disable cookies through your browser settings. Disabling essential cookies may affect your ability to use the Platform.

You can opt out of Google Analytics data collection at tools.google.com/dlpage/gaoptout.

Cookies do not in themselves contain personal information, but they may be combined with other information to identify you. We use cookies only for the purposes described above, do not use them to serve advertising within the Platform, and delete analytics data collected via cookies every 30 days.

See also our Cookie Policy.

11. Document Verification Service additional disclosures

This section sets out additional information required under the DVS Access Policy Version 5.2 (July 2025), the IVS Act, and our DVS Business User Participation Agreement.

11.1 Purpose of DVS use

Rapid Return uses the DVS solely to verify the identity of individuals before providing tax agent services. This is reasonably necessary for our functions and activities and is consistent with Australian Privacy Principle 9.2(a).

11.2 How the DVS works

The DVS is a secure online system administered by the Australian Attorney-General's Department. It confirms whether the details on your identity document match the records held by the issuing government agency. The DVS returns only a pass, fail, or error result and does not return your document details to us.

11.3 Third-party systems involved

  • GBG Pty Ltd, our approved DVS Gateway Service Provider, which connects the Platform to the DVS Hub.
  • The DVS Hub, the central government identity verification system administered by the Attorney-General's Department.
  • The relevant Official Record Holder for the document type you present, such as the Department of Home Affairs, state or territory road authorities, or Services Australia.

11.4 Consent

Before any DVS verification check is initiated, you are presented with a DVS Identity Verification Consent Notice explaining the verification process, your rights, and how to make a complaint. Your express informed consent is required before any verification request is submitted. If you decline to consent, we will not be able to provide tax agent services to you.

11.5 Restrictions on use of DVS data

  • We will not use identity document details obtained via the DVS for any purpose other than verifying your identity.
  • We will not use DVS data to create a data profile of you or track your behaviour.
  • We will not use DVS data for advertising, marketing, or offering goods or services.
  • We will not disclose DVS information match results to any party other than as permitted under the Participation Agreement.

11.6 Complaints about DVS

If you have a complaint about how your identity document details have been handled in connection with the DVS, contact us using the details in Section 15. You may also contact the OAIC or the Attorney-General's Department in relation to the DVS framework.

12. Children and young people

We can prepare and lodge tax returns on behalf of individuals under 18 years of age. Where a tax return is being prepared for a minor, we may collect that minor's personal information, including TFN, income details, and identity verification information.

Where a parent or guardian acts on behalf of a child, that parent or guardian is responsible for ensuring the information provided is accurate and that they have authority to provide it on the child's behalf. Consent to identity verification for a minor will be obtained from the parent or guardian where required.

If you believe we hold personal information about a child that was provided without appropriate authorisation, contact us using the details in Section 15.

13. Accessing and correcting your personal information

Under the Privacy Act, you may request access to the personal information we hold about you and request corrections where information is inaccurate, incomplete, out of date, irrelevant, or misleading.

  • Requests can be made using the contact details in Section 15.
  • We will respond within a reasonable time, typically within 30 days, and may need to verify your identity first.
  • We do not charge a fee for making an access or correction request, although a reasonable administrative fee may apply for providing access in limited circumstances.
  • If we decline your request, we will provide written reasons, subject to the limited exceptions allowed by law.

14. Privacy complaints

If you believe we have not handled your personal information in accordance with the Privacy Act or this Privacy Policy, you may make a complaint to our Privacy Officer in the first instance. We will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response, you may contact the OAIC:

  • Website: www.oaic.gov.au
  • Phone: 1300 363 992.
  • Post: GPO Box 5218, Sydney NSW 2001.

If your complaint relates to our conduct as a registered tax agent, you may also contact the Tax Practitioners Board:

15. Contact us

For all privacy enquiries, access and correction requests, or complaints, contact our Privacy Officer:

16. Updates to this Privacy Policy

We review and update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or business environment. When we make material changes, we will post the updated policy on our website and, where required by law, notify you by email.

The effective date at the top of this page indicates when this policy was last updated. The current version of this Privacy Policy is available on this page at rapidreturn.com.au/legal/privacy-policy.

Your continued use of the Platform after any update constitutes your acceptance of the revised policy.